McAfee VirusScan DUNZIP32.dll Buffer Overflow Vulnerability

Information about new, fixed McAfee VirusScan DUNZIP32.dll Buffer Overflow Vulnerability has been published today at security advisory http://www.networksecurity.fi/advisories/mcafee-virusscan.html Mitre.org assigned the name CVE-2004-1094 to this issue. Best regards, Juha-Matti Laurio,...

CVE-2005-4505

Unquoted Windows search path vulnerability in McAfee VirusScan Enterprise 8.0i patch 11 and CMA 3.5 patch 5 might allow local users to gain privileges via a malicious "program.exe" file in the C: folder, which is run by naPrdMgr.exe when it attempts to execute EntVUtil.EXE under an unquoted...

CVE-2005-4505

Unquoted Windows search path vulnerability in McAfee VirusScan Enterprise 8.0i patch 11 and CMA 3.5 patch 5 might allow local users to gain privileges via a malicious "program.exe" file in the C: folder, which is run by naPrdMgr.exe when it attempts to execute EntVUtil.EXE under an unquoted...

CVE-2005-4505

CVE-2005-4505 describes an unquoted Windows search path vulnerability in McAfee VirusScan Enterprise 8.0i (patch 11) and CMA 3.5 (patch 5). The underlying issue is an unquoted Program Files path that causes naPrdMgr.exe to execute EntVUtil.EXE, enabling local users to gain privileges via a malici...

CVE-2005-4505: Undefined Security Weakness

Unquoted Windows search path vulnerability in McAfee VirusScan Enterprise 8.0i patch 11 and CMA 3.5 patch 5 might allow local users to gain privileges via a malicious "program.exe" file in the C: folder, which is run by naPrdMgr.exe when it attempts to execute EntVUtil.EXE under an unquoted...

McAfee VirusScan 8.0 - Path Specification Privilege Escalation

// source: https://www.securityfocus.com/bid/16040/info McAfee VirusScan is prone to a vulnerability that could allow an arbitrary file to be executed. The 'naPrdMgr.exe' process calls applications without using properly quoted paths. Successful exploitation may allow local attackers to gain...

McAfee VirusScan 8.0 - Path Specification Privilege Escalation

McAfee VirusScan 8.0 - Path Specification Privilege Escalation // source: https://www.securityfocus.com/bid/16040/info McAfee VirusScan is prone to a vulnerability that could allow an arbitrary file to be executed. The 'naPrdMgr.exe' process calls applications without using properly quoted paths...

CVE-2005-3657

The ActiveX control in MCINSCTL.DLL for McAfee VirusScan Security Center does not use the IObjectSafetySiteLock API to restrict access to required domains, which allows remote attackers to create or append to arbitrary files via the StartLog and AddLog methods in the MCINSTALL.McLog object...

CVE-2005-3657

The CVE-2005-3657 issue affects McAfee Security Center’s MCINSCTL.DLL ActiveX control. The McLog object (MCINSTALL.McLog) allows logging, but the control does not restrict which domains may load it because it does not use the IObjectSafetySiteLock API. This enables remote attackers to create or a...

CVE-2005-3657: Undefined Security Weakness

The ActiveX control in MCINSCTL.DLL for McAfee VirusScan Security Center does not use the IObjectSafetySiteLock API to restrict access to required domains, which allows remote attackers to create or append to arbitrary files via the StartLog and AddLog methods in the MCINSTALL.McLog object...

McAfee VirusScan unauthorized files access

It's possible to access client computer files with McAfee Security Center MCINSCTL.DLL ActiveX...

[Full-disclosure] iDefense Security Advisory 12.20.05: McAfee Security Center MCINSCTL.DLL ActiveX Control File Overwrite

McAfee Security Center MCINSCTL.DLL ActiveX Control File Overwrite iDefense Security Advisory 12.20.05 http://www.idefense.com/intelligence/vulnerabilities/display.php?id=358 December 20, 2005 I. BACKGROUND McAfee VirusScan is an anti-virus software. More information is available from the vendor...

CVE-2004-0831

McAfee VirusScan 4.5.1 does not drop SYSTEM privileges before allowing users to browse for files via the "System Scan" properties of the System Tray applet, which could allow local users to gain privileges...

CVE-2004-0831

CVE-2004-0831 concerns McAfee VirusScan 4.5.1. The vulnerability arises when using the System Scan options in the System Tray applet, where the process does not drop SYSTEM privileges before enabling users to browse for files, potentially allowing local privilege escalation. The description provi...

CVE-2004-0831: Undefined Security Weakness

McAfee VirusScan 4.5.1 does not drop SYSTEM privileges before allowing users to browse for files via the "System Scan" properties of the System Tray applet, which could allow local users to gain privileges...

CVE-2004-0831

McAfee VirusScan 4.5.1 does not drop SYSTEM privileges before allowing users to browse for files via the "System Scan" properties of the System Tray applet, which could allow local users to gain privileges...

CVE-2000-0502

Mcafee VirusScan 4.03 does not properly restrict access to the alert text file before it is sent to the Central Alert Server, which allows local users to modify alerts in an arbitrary fashion...

CVE-2000-0502

Mcafee VirusScan 4.03 is affected by a local-access restriction flaw in the alert text file before it is sent to the Central Alert Server, allowing local users to modify alerts and impact the integrity of alert data. The root cause is improper access restriction of the alert file, enabling unauth...

CVE-2000-0502: Undefined Security Weakness

Mcafee VirusScan 4.03 does not properly restrict access to the alert text file before it is sent to the Central Alert Server, which allows local users to modify alerts in an arbitrary fashion...

CVE-2002-2282

McAfee VirusScan 4.5.1, when the WebScanX.exe module is enabled, searches for particular DLLs from the user's home directory, even when browsing the local hard drive, which allows local users to run arbitrary code via malicious versions of those DLLs...